{"record":{"id":"714bb300a6e5af48","repo":"BerriAI/litellm","slug":"user-not-allowed-to-access-proxy-user-role-user","errorCode":null,"errorMessage":"User not allowed to access proxy. User role={user_role}, proxy mode={ui_access_mode}","messagePattern":"User not allowed to access proxy\\. User role=(.+?), proxy mode=(.+?)","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"litellm/proxy/management_endpoints/ui_sso.py","lineNumber":3578,"sourceCode":"            table_name=\"key\",\n        )\n\n        key = response[\"token\"]\n        user_id = response[\"user_id\"]\n\n        user_role = user_defined_values[\"user_role\"] or LitellmUserRoles.INTERNAL_USER_VIEW_ONLY.value\n        if user_id and isinstance(user_id, str):\n            user_role = await check_and_update_if_proxy_admin_id(\n                user_role=user_role, user_id=user_id, prisma_client=prisma_client\n            )\n\n        verbose_proxy_logger.debug(\"user_role: %s; ui_access_mode: %s\", user_role, ui_access_mode)\n        ## CHECK IF ROLE ALLOWED TO USE PROXY ##\n        is_admin_only_access: Final = check_is_admin_only_access(ui_access_mode or {})\n        if is_admin_only_access:\n            has_access: Final = has_admin_ui_access(user_role or \"\")\n            if not has_access:\n                raise HTTPException(\n                    status_code=401,\n                    detail={\n                        \"error\": f\"User not allowed to access proxy. User role={user_role}, proxy mode={ui_access_mode}\"\n                    },\n                )\n\n        if isinstance(user_id, str) and user_id:\n            await retain_sso_identity_assertion_for_ema(user_id=user_id, assertion=sso_assertion)\n\n        disabled_non_admin_personal_key_creation: Final = get_disabled_non_admin_personal_key_creation()\n        litellm_dashboard_ui = get_custom_url(request_base_url=str(request.base_url), route=\"ui/\")\n\n        if get_secret_bool(\"EXPERIMENTAL_UI_LOGIN\"):\n            _user_info: LiteLLM_UserTable | None = None\n            if user_defined_values is not None and user_defined_values[\"user_id\"] is not None:\n                _user_info = LiteLLM_UserTable(\n                    user_id=user_defined_values[\"user_id\"],\n                    user_role=user_defined_values[\"user_role\"] or user_role,","sourceCodeStart":3560,"sourceCodeEnd":3596,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/proxy/management_endpoints/ui_sso.py#L3560-L3596","documentation":"Error \"User not allowed to access proxy. User role={user_role}, proxy mode={ui_access_mode}\" thrown in BerriAI/litellm.","triggerScenarios":"Thrown at litellm/proxy/management_endpoints/ui_sso.py:3578 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an account whose role is permitted by the proxy's ui_access_mode, or ask the admin to adjust ui_access_mode."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}